Make a role for an AI client

Give an AI client only the folders it needs, with a small role made just for it. Easier to reason about, and easy to spot later and revoke.

Owner Admin AI user

When you connect an AI client, you pick which of your custom roles it gets. If your only role gives you a lot of access, so does the client. A small role made for the client’s job is safer, and easy to spot later on the AI agents page.

Creating roles needs an Owner or Admin. If that’s not you, send them this page.

Set it up

Open Roles and select Create role. Choose Start empty.
Name it after the job, like “AI: read approved exports”.
Add one rule: Allow, the connection and bucket, the folder in Prefix, and tick Read. Tick Write only if the client needs to upload.
Select Save role.
On People, give the role to the person who’ll connect the AI client, and select Save.

That person will see the role on the consent screen, alongside their other roles.

Tips

Give Read only, unless the client really needs to upload. Through MCP, Write lets the client upload and overwrite files, but not delete them.
Point the rule at one folder rather than a whole bucket.
If the client must stay out of one sub-folder, add a Deny rule for it. Deny always wins, even over the person’s other roles if they select those too.
Before connecting the client, have the person open the folder in the web app to check the role works.

More patterns in folder access recipes.